Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLFrameOwnerElement.h

Index: Source/core/html/HTMLFrameOwnerElement.h
diff --git a/Source/core/html/HTMLFrameOwnerElement.h b/Source/core/html/HTMLFrameOwnerElement.h
index b357720863943b9515d90e68ce5832fe0789d5cb..58e2097fb25384bfd745dee405c4299e34b4b86b 100644
--- a/Source/core/html/HTMLFrameOwnerElement.h
+++ b/Source/core/html/HTMLFrameOwnerElement.h
@@ -48,7 +48,7 @@ public:
     void setContentFrame(Frame&);
     void clearContentFrame();
 
-    void disconnectContentFrame();
+    virtual void disconnectContentFrame();
 
     // Most subclasses use RenderPart (either RenderEmbeddedObject or RenderIFrame)
     // except for HTMLObjectElement and HTMLEmbedElement which may return any
@@ -65,7 +65,7 @@ public:
     virtual void renderFallbackContent() { }
 
     virtual bool isObjectElement() const { return false; }
-    void setWidget(PassRefPtr<Widget>);
+    void setWidget(PassRefPtrWillBeRawPtr<Widget>);
     Widget* ownedWidget() const;
 
     class UpdateSuspendScope {
@@ -95,7 +95,7 @@ private:
     virtual void dispatchLoad() override;
 
     RawPtrWillBeMember<Frame> m_contentFrame;
-    RefPtr<Widget> m_widget;
+    RefPtrWillBeMember<Widget> m_widget;
     SandboxFlags m_sandboxFlags;
 };